CVE-2024-28995
SolarWinds Serv-U Path Traversal Vulnerability
Description
CVE-2024-28995 is a high-severity directory traversal vulnerability in SolarWinds Serv-U that allows unauthenticated remote attackers to read sensitive files on the host machine. With a CVSS v3.1 base score of 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), the vulnerability features a changed scope, meaning exploitation of the Serv-U application enables reading files beyond the application's own security context. Affected versions include Serv-U prior to 15.4.2 and version 15.4.2 itself (before the hotfix). CISA has listed this vulnerability in its KEV catalog with a remediation deadline of August 7, 2024. The EPSS score of 0.94367 (100.0th percentile) indicates maximum exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| solarwinds | serv-u | < 15.4.2; 15.4.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28995(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28995(US Government Resource)
Weakness Type
Directory Traversal (Path Traversal)
CVE-2024-28995 is a directory traversal vulnerability, also known as path traversal, where the application fails to properly sanitize file path input, allowing an attacker to use special character sequences (such as "../") to navigate outside the intended directory structure. In SolarWinds Serv-U, the file transfer server accepts user-supplied path values in requests but fails to adequately validate or restrict these paths. An attacker can craft requests containing directory traversal sequences that escape the Serv-U data directory and access arbitrary files on the underlying operating system, including configuration files, credentials, and other sensitive data.
Impact Analysis
Arbitrary File Read on File Transfer Servers is the core risk of CVE-2024-28995. SolarWinds Serv-U is a widely deployed managed file transfer (MFT) solution used by organizations to exchange sensitive files securely. A directory traversal vulnerability in this context is particularly dangerous because file transfer servers are typically internet-facing and handle sensitive data.
Confidentiality Impact is maximum with changed scope (C:H, S:C). The changed scope (S:C) indicates that the vulnerability in Serv-U allows reading files outside the application's own security boundary, accessing files belonging to the host operating system and other applications. An attacker can read system configuration files such as /etc/passwd on Linux or Windows SAM database files, application configuration files containing database credentials, SSH private keys, SSL/TLS certificates and private keys, and any other file readable by the Serv-U process.
Integrity Impact is none (I:N). The vulnerability only enables reading files; it does not allow modification or creation of files on the target system.
Availability Impact is none (A:N). File reading operations do not directly affect system availability, though the information gathered can facilitate follow-up attacks that do.
Strategic Exploitation Value: File transfer servers like Serv-U often contain or have access to highly sensitive business data including financial records, healthcare information, legal documents, and intellectual property. The directory traversal allows attackers to bypass all file access controls and read any file on the system. The EPSS score of 0.94367 (100.0th percentile) and CISA's KEV listing confirm that this is among the most actively exploited vulnerabilities. CISA lists the ransomware association as "Unknown," but the credentials and system information obtainable through exploitation can serve as an entry point for ransomware deployment.
Exploit Maturity
CVE-2024-28995 is confirmed as actively exploited in the wild, as documented by its listing in CISA's KEV catalog with a remediation deadline of August 7, 2024. The EPSS score of 0.94367 at the 100.0th percentile places this in the highest exploitation probability tier.
Trivial Exploitation: Directory traversal vulnerabilities are among the simplest to exploit. An attacker needs only to craft HTTP requests with path traversal sequences (such as "../") to navigate out of the Serv-U web root and read arbitrary files. No authentication, special tools, or sophisticated techniques are required. Basic tools like curl or a web browser can be used to exploit the vulnerability.
Internet-Facing Attack Surface: SolarWinds Serv-U is designed to be internet-accessible for file transfer operations, providing a broad attack surface for unauthenticated exploitation. Automated scanners can quickly identify Serv-U instances and attempt directory traversal exploitation at scale.
Vendor Advisory: SolarWinds published a security advisory with patch information and remediation guidance.
SolarWinds Target Profile: SolarWinds products have been high-profile targets since the 2020 supply chain attack, and threat actors continue to actively search for and exploit vulnerabilities in SolarWinds products. This heightened threat actor interest makes rapid patching critical.
Ransomware Association: CISA lists the ransomware status as "Unknown." However, the credentials and system information obtainable through the directory traversal can enable full system compromise and subsequent ransomware deployment.
Remediation
-
Update SolarWinds Serv-U to the patched version by applying the hotfix documented in the SolarWinds security advisory for CVE-2024-28995. For versions prior to 15.4.2, upgrade to version 15.4.2 with the security hotfix applied. Verify the update through the Serv-U management console version information.
-
Audit file system access on Serv-U servers for signs of prior exploitation. Review web server logs for requests containing directory traversal patterns such as "../", "..", or URL-encoded variants ("%2e%2e%2f"). Check for unusual file access patterns, particularly attempts to read system files like /etc/passwd, /etc/shadow, Windows SAM files, or configuration files outside the Serv-U directory.
-
Deploy web application firewall rules to detect and block directory traversal attempts targeting Serv-U instances. Configure WAF rules to inspect request paths for traversal sequences and block requests that attempt to navigate outside the intended file transfer directories. This provides defense-in-depth while patches are applied.
-
Rotate credentials and certificates stored on systems running vulnerable Serv-U versions, as these may have been read by attackers prior to patching. This includes SSL/TLS private keys, SSH keys, database credentials, service account passwords, and any other sensitive data stored on the file system that was accessible to the Serv-U process.
-
Implement network segmentation to minimize the data accessible through the Serv-U server's file system. Run Serv-U with a dedicated service account that has minimal file system permissions. Restrict the service account's read access to only the directories required for file transfer operations, limiting the impact of any future directory traversal vulnerabilities.
Technical Details
CVE-2024-28995 is a directory traversal vulnerability in SolarWinds Serv-U that enables unauthenticated remote file reading across the host file system.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N produces a base score of 8.6. The network attack vector (AV:N) confirms remote exploitability. Low attack complexity (AC:L) reflects the simplicity of directory traversal exploitation. No privileges (PR:N) or user interaction (UI:N) are required. Critically, the scope is changed (S:C), meaning the vulnerability in the Serv-U application enables access to resources beyond its security boundary, specifically the host operating system's file system. Confidentiality impact is high (C:H), while integrity (I:N) and availability (A:N) are unaffected.
Vulnerability Mechanism: SolarWinds Serv-U processes file access requests through its web interface and FTP/SFTP services. The application accepts file path parameters in client requests but fails to properly sanitize these paths for directory traversal sequences. An attacker can include sequences like "../" (or URL-encoded equivalents) in request parameters to navigate up from the Serv-U data directory into the host file system. The application processes the traversed path and returns the contents of the requested file to the attacker.
Changed Scope Significance: The changed scope (S:C) in the CVSS vector is significant because it indicates that the vulnerability in Serv-U (the vulnerable component) enables access to resources in a different security context (the host operating system). While Serv-U is designed to provide controlled access to specific file directories, this vulnerability breaks that boundary and allows reading any file accessible to the Serv-U process on the host system.
Affected Versions: SolarWinds Serv-U versions prior to 15.4.2 and version 15.4.2 itself (without the hotfix) are vulnerable. The vulnerability exists in the web-based file access interface and can be exploited through standard HTTP requests without authentication.
Frequently Asked Questions
What is CVE-2024-28995?
CVE-2024-28995 is a directory traversal vulnerability in SolarWinds Serv-U that allows unauthenticated remote attackers to read any file on the host system that is accessible to the Serv-U process. An attacker can use path traversal sequences to escape the intended file directories and access sensitive system files.
What data can an attacker access through CVE-2024-28995?
An attacker can potentially read any file on the Serv-U host system that the Serv-U service account has permission to access. This includes system configuration files, password files, SSH keys, SSL/TLS certificates and private keys, application configuration files, database credentials, and any files stored on the server including transferred business documents.
Is CVE-2024-28995 being actively exploited?
Yes. CISA has confirmed active exploitation by listing it in the KEV catalog. The EPSS score of 0.94367 (100.0th percentile) indicates it is one of the most actively exploited vulnerabilities currently tracked. The simplicity of directory traversal exploitation and the internet-facing nature of Serv-U servers make this an attractive and easily scalable target.
Why is the scope "changed" in the CVSS score?
The changed scope (S:C) indicates that exploiting the vulnerability in Serv-U allows access to resources beyond the application's own security boundary. While Serv-U is designed to provide controlled access to specific directories, this vulnerability breaks that containment and exposes the entire host file system, which represents a different security context.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.